0 Replies Latest reply: Nov 15, 2011 11:05 AM by Mia Axelsson RSS

LdapExtLoginModule + multiple  baseCtxDN

Mia Axelsson Newbie

Hi!

I´m using e-directory and our tree has 2 Organization (O) and i want to use booth in baseCtxDN or in some other way.

How can i do that? I can get the users in O=org1 to login but not from O=org2. If i change baseCtxDN to O=org2 the users in org2 can login.

 

I have tried to use 2 baseCtxDN, dose´t work. I have used baseCtxDN T=treename, does´t work. I have used blanc baseCtxDN, don´t work. I have tried no baseCtxDN, don´t work.

I tried to use double <login-module code> in same  <application-policy name>, don´t work. I used 2 <application-policy name = "jmx-console">, dont work. Anybody knows?

 

My login-config.xml looks something like this.

<application-policy name = "jmx-console">
<authentication>
<login-module code="org.jboss.security.auth.spi.LdapExtLoginModule" flag="required">
<module-option name="java.naming.factory.initial">com.sun.jndi.ldap.LdapCtxFactory</module-option>
<module-option name="java.naming.provider.url">ldaps://xxx:636/</module-option>
<module-option name="java.naming.security.authentication">simple </module-option>
<!-- Rebind as a user with search priviledges for the role queries -->
<module-option name="java.naming.security.principal">cn=xxx,ou=xxx,o=org1</module-option>
<module-option name="java.naming.security.credentials"></module-option>
<module-option name="baseCtxDN">o=Org1</module-option>
<module-option name="baseFilter">(cn={0})</module-option>
<module-option name="rolesCtxDN">ou=xxx,ou=xxx,ou=xxx,o=org1</module-option>
<module-option name="uidAttributeID">member</module-option>
<module-option name="roleFilter">(member={1})</module-option>
<module-option name="roleAttributeID">cn</module-option>
<module-option name="roleAttributeIsDN">false</module-option>
<module-option name="searchTimeLimit">5000</module-option>
<module-option name="searchScope">ONELEVEL_SCOPE</module-option>
<module-option name="java.naming.security.protocol">ssl</module-option>
<module-option name="allowEmptyPasswords">false</module-option>

</login-module>
</authentication>
</application-policy>

 

Many Thanks!!!